Lucene search

GoogleOSV:GHSA-PW5C-XQF2-6XC2

HistoryMay 17, 2022 - 3:44 a.m.

Doctrine Security Misconfiguration Vulnerability

2022-05-1703:44:28

Google

osv.dev

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.

CPENameOperatorVersion
doctrine/annotationseq1.2.5
doctrine/mongodb-odmeq1.0.0-BETA8
doctrine/annotationseq1.2.3
doctrine/annotationseq1.2.1
doctrine/commoneq2.2.0-RC3
aws/aws-sdk-phpeq3.0.6
doctrine/commoneq2.3.0-BETA1
zendframework/zendframeworkeq2.4.3
zendframework/zendframeworkeq2.4.2
doctrine/commoneq2.2.0BETA1

Name	Operator	Version
doctrine/annotations	eq	1.2.5
doctrine/mongodb-odm	eq	1.0.0-BETA8
doctrine/annotations	eq	1.2.3
doctrine/annotations	eq	1.2.1
doctrine/common	eq	2.2.0-RC3
aws/aws-sdk-php	eq	3.0.6
doctrine/common	eq	2.3.0-BETA1
zendframework/zendframework	eq	2.4.3
zendframework/zendframework	eq	2.4.2
doctrine/common	eq	2.2.0BETA1

Rows per page:

1-10 of 1151

References

framework.zend.com/security/advisory/ZF2015-07

www.debian.org/security/2015/dsa-3369

www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html

framework.zend.com/security/advisory/ZF2015-07

github.com/aws/aws-sdk-php/releases/tag/3.2.1

github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2015-5723.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015-5723.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5723.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cache/CVE-2015-5723.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5723.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5723.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-doctrine/CVE-2015-5723.yaml

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67

lists.fedoraproject.org/archives/list/[email protected]/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO

lists.fedoraproject.org/archives/list/[email protected]/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67

nvd.nist.gov/vuln/detail/CVE-2015-5723